feat(daemon): csp nonce handling

[bgajjala8]

Description

This PR adds nonce handling to support UI features. The changes include a new wrapper to apply CSP with a crypto nonce value and adjust injection of the nonce into returned HTML. This change will take place in tandem with a UI PR

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.
• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
• If applicable, I've documented the impact of any changes to security controls.
  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

[Copilot]

Pull request overview

Adds CSP nonce handling for controller-served UI responses by generating a per-document nonce, injecting it into the CSP header, and rewriting the served index.html to replace a placeholder value.

Changes:

• Add wrapHandlerWithCsp middleware to generate/inject a CSP nonce for UI “document” requests and preserve default CSP for static assets.
• Add a ResponseWriter wrapper to replace a CSP placeholder in index.html with a runtime value.
• Add unit tests covering CSP header nonce injection behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
internal/daemon/controller/handler_ui.go	Wraps UI document responses to replace a CSP placeholder in returned HTML.
internal/daemon/controller/handler_test.go	Adds tests for the new CSP wrapping middleware behavior.
internal/daemon/controller/handler.go	Introduces and wires a CSP middleware that injects a nonce for UI document requests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[ZedLi]

Tested and works as expected for me!